The PHP development team is preparing to release patches for two critical security vulnerabilities. According to the Common Vulnerability Scoring System (CVSS) 4.0, both flaws have been assigned a severity score of 9.2.
The European Union's Computer Emergency Response Team (CERT-EU) reported that these vulnerabilities allow for unauthenticated remote code execution. Attackers could potentially run malicious code on affected servers without needing to log in.
CERT-EU has advised organizations to prepare for immediate patching once the updates are available. Entities unable to apply the fixes promptly are urged to take their affected websites offline to prevent potential compromises.
The Australian Cyber Security Centre (ACSC) has issued similar guidance, recommending that organizations audit their systems for PHP usage and monitor for signs of malicious activity. As of now, the ACSC has not observed any active exploitation of these vulnerabilities.
Hosting provider GoDaddy warned that successful exploitation could lead to data theft, website defacement, or full system compromise. While the PHP team noted that versions from PHP 5 onwards might be affected, specific details on vulnerable versions will be disclosed alongside the patches.
